Can a wildcard SSL certificate be issued for a second level domain?

Question

Something like *.com or *.net? How about *.edu.au?

The RFC 2818 does not say anything about this topic.

Answer 1

Yes, it can be issued.

Luckily the common browsers do not accept wildcard certificates for TLDs.

Chromium Source Code:

DCHECK(reference_domain.starts_with("."));
// We required at least 3 components (i.e. 2 dots) as a basic protection
// against too-broad wild-carding.
// Also we don't attempt wildcard matching on a purely numerical hostname.
allow_wildcards = reference_domain.rfind('.') != 0 &&
    reference_name.find_first_not_of("0123456789.") != std::string::npos;

IE even rejects *.co.uk, but I am pretty sure the list is not complete.

In the list of fake certificates issued by DigiNotar, there is "*.*.com". This is obviously an attempt to get around the restriction.

Answer 2

I have tested this on common browsers, the three big ones (on windows anyways) don't accept this. What I haven't done is try it on the mobile platforms which imo are the real target of this attack. Since iOS doesn't have a way to revoke certificates there are millions of i-devices out there that are vulnerable until apple releases a patch, and they apply it.

Obvious places to try this with high impact: Activesync to exchange, ssl vpn clients, safari on idevices, stock browser on androids.